News · 2026-11-12

Researchers find 31,000 secrets saved by Claude Code's 'don't ask again' in public repos

A permission prompt in Claude Code is also a decision to store data, and two security firms say that decision has leaked tens of thousands of credentials into public repositories. GitGuardian counted 31,088 distinct secrets in .claude/settings.local.json files across 23,276 public GitHub repositories, 5,343 of them still valid when detected, according to CSO Online's November 11 report of the research.

Key facts

• GitGuardian (via CSO Online, November 11): 31,088 secrets, 23,276 repos, 5,343 valid; about 67% of the occurrences they could check were working credentials.
• Apiiro (blog dated November 5): of 104,185 public copies of the file, 1,122 (about 1.1%) held real secrets, 1,379 distinct ones.
• Mechanism: choosing "Yes, and don't ask again" writes the exact command, secret included, as an allow rule.
• Primary sources: CSO Online, the Apiiro blog, and GitHub issue #5544.

How a click becomes a leak

Claude Code asks permission before certain shell commands. If you choose "Yes, and don't ask again", it saves an allow rule in .claude/settings.local.json that matches the exact command string. If that command carried a token in a curl header, a database password or an SSH password, the secret now sits in plain text. Claude Code adds the file to the developer's global Git ignore, so it normally stays out of commits on that machine. Apiiro's point, as relayed by Dark Reading, is that the rule never goes into the repo's own .gitignore, so anyone who clones the repo, works on another machine or already has the file tracked can commit it. We covered an earlier report of this pattern in Claude Code permission rules can preserve secrets.

GitGuardian found a second path: a Dockerfile line COPY . . ignores .gitignore, so .claude/ can be baked into public Docker Hub images unless .dockerignore excludes it. It found 613 distinct secrets, 99 valid, across 543 image repositories and 7,625 tags. One valid Cloudflare API token appeared in 559 tags. Deleting the file from GitHub does not recall credentials already inside published images.

The numbers, and why not to merge them

Apiiro's 1,122 files and GitGuardian's 23,276 repositories come from different samples and methods, so they cannot be added or compared directly; the gap likely reflects a wider crawl over a longer window, though neither firm explains it. GitGuardian says the largest valid category was database identifiers (2,280 distinct credentials), followed by cloud provider and AI tokens, and that monthly leaks peaked at 12,535 occurrences in April 2026 and fell to 959 by October. Researcher Guillaume Valadon said "we do not yet know what changed." The shared .claude/settings.json file held another 8,271 secrets, 1,283 of them valid.

Apiiro, whose researchers are Shmulik Cohen and Matan Giladi, named examples including a production Azure Postgres password, a Square production token and the owner password of a medical-records database, mostly belonging to individual developers across 63 organizations. Dark Reading, quoting Apiiro, says that in 539 of 1,105 secret-bearing repositories a commit co-authored by Claude Code had modified the settings file. Apiiro sells application-security products, so this is vendor research, and it did not test whether credentials still worked.

Both firms say standard scanners miss many of these: values like passwords and arbitrary tokens have no recognizable provider format, so tools such as gitleaks and TruffleHog skip them.

The bug was reported in 2025

GitHub issue #5544 on anthropics/claude-code, "approved bash commands containing credentials are stored as is with plain text credentials in settings.local.json", was opened on August 11, 2025 with area:security and has repro labels. A bot warned it might be auto-closed as a duplicate. It was closed "not planned" on January 3, 2026 for inactivity and locked a week later. The behavior was reported fifteen months before the research and the issue closed without a fix.

Anthropic's response and expert reaction

Per the coverage, Boris Cherny, head of Claude Code, said Claude Code has not done secrets scrubbing and the company is looking at what it can do, including built-in secret scanning and an auto mode. CSO says Anthropic did not respond to its own request for comment. A secondary summary says Cherny disputes Apiiro's reading of the co-authored commits; we could not find that in a primary source and have left it out.

Seemant Sehgal of BreachLock calls it a "dead zone": clicking "don't ask again" is "a decision to write a [secret] into a file, and many developers clicking it likely don't know that file exists." Ryan McCurdy of Liquibase said "Nobody intended to expose them, but the workflow made it possible."

What to do

Rotate every secret that ever appeared in a command you approved. Run git rm --cached on the file, add .claude/ to both .gitignore and .dockerignore, and delete saved allow rules containing secrets. Prefer pattern rules such as npm test * over exact commands, and keep credentials in environment variables or a secrets manager. The deeper lesson is about agent identity and scoped credentials: the setting meant to save a click became a persistent credential store, and the fix is mostly practice, not model safety.

A circulating Reddit title, "the world's most expensive prompt injection", could not be matched to any source, so we do not cover it here.

Primary source, verified: read the paper →

Ground Truth. (2026, November 12). Researchers find 31,000 secrets saved by Claude Code's 'don't ask again' in public repos. Ground Truth. https://groundtruth.day/news/claude-code-dont-ask-again-secrets-found-in-23000-public-repositories.html

@misc{groundtruth:claude-code-dont-ask-again-secrets-found-in-23000-public-repositories,
  title  = {Researchers find 31,000 secrets saved by Claude Code's 'don't ask again' in public repos},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {nov},
  url    = {https://groundtruth.day/news/claude-code-dont-ask-again-secrets-found-in-23000-public-repositories.html}
}

Topics: cybersecurity · ai-security · supply-chain · claude-code · secrets · agents